negative auth cache?